As of MBRtool version 2 the VRM numbering method is used. This means
that the number consists of a Version-number, a Release-number and a
Modification-number (and yes, I was inspired by IBM when I thought this
up).

The Version-number changes when major functional changes to the
program are introduced.

The Release-number changes when minor functional changes and/or major
corrective changes to the program are introduced.

The Modification-number changes when minor and/or major corrective
changes to the program are introduced.

CAUTION: changing things in the MBR can be destructive,
whether that is intentional or not. Whenever you decide to change
something in the MBR, always make a backup first. The backup and
restore routines of MBRtool have been tested extensively and are
reliable. If something should go wrong during an action that changes
something in a MBR, you will be happy that you've made that backup.

In the world of disks and data recovery we start counting disks at 0 (zero). So the first disk is
disk 0, the second disk is disk 1, etc.
When working with disks on a level close to the hardware the first disk
in the system is disk 128, the second is 129, etc. So disk 0 and disk
128 are the same disk, disk 1 and disk 129 are the same, etc. Both of
these conventions (0-based and 128-based) are used by MBRtool.

This document assumes the reader to have
some knowledge concerning hard disks and partitioning. You should know what
the Master Boot Record is and what Partition Tables are. We also assume you know how to make
a real-mode boot disk and have at least working knowledge of the Windows
operating system(s) and real mode
environments. You should also know what Simple and Dynamic volumes are
(used in Windows 200X / XP / Vista / Win7) and what the Windows NT4 equivalents are
(Stripesets and Mirrorsets).

Copyright, disclaimer,
permission and distribution notices

This program is conceived and coded by Tom
Kuurstra.
(C) 2000-2016, DIYDataRecovery.nl

All the Information and/or Programs
supplied by us (DIYDataRecovery) are AS IS. Use of this Information and/or
Programs is at your own risk. We can not and will not be held
responsible for any damage that is inflicted by the person
and/or persons using the Information and/or Programs we supply.

You may not include (parts of) this program in your
own code and/or programs. Please check below for redistribution notices.

You, as the user, are not permitted to:

decompile, disassemble or change the program code
in any way;

change the documentation or any text accompanying
the program;

change the distribution in any way. No files may be
removed from and no files may be added to the distribution;

use this program for commercial reasons or in
environments (i.e. companies or persons) that (make a) profit from data recovery;

(re)sell the program, or accept any fee for
distributing or using the program

This program is distributed as Freeware. You are free
to use and distribute this program, as long as you comply with the above mentioned
rules.

A word
about the MBR

Introduction

The Master Boot Record (or MBR) is the very first sector of a hard disk. This very important sector contains a number of things that
the Operating System and the computer BIOS need to start the system. If
the contents of this sector are lost or damaged you can not access the
data on the hard disk. Please note that each hard disk has a MBR, so if
you have 2 or more hard disks in your computer, each has its own MBR. If
multiple disks are configured as an array there is usually 1 MBR that
services the entire array, placed on the 1st disk in the array (there
are exceptions to this rule, but that is beyond the scope of this
manual). It should be clear that the MBR is one of the most important
(and, strangely enough, overlooked) sectors on your hard disk.
The following explanation is mainly about using the MBR with Windows or
DOS based operating systems. The MBR is somewhat different when used
with Unix based systems.

Details

The smallest addressable space on a hard disk is 512 bytes at a time.
A hard disk sector is 512 bytes long, so 1 sector is the smallest
addressable space on a hard disk. The MBR is 1 sector, so the MBR is 512
bytes long. These 512 bytes are divided into several parts that each
have their own function in getting the computer to start. The 4 main
parts of the MBR are (in the order as they appear in the MBR):

the bootcode

the volume bytes

the partition table

the signature bytes

The bootcode: this part of the MBR gets read by the computer BIOS
when the computer is started. When the computer finishes its own
startup procedures (getting the disks spinning, doing some checks) and
gets ready to start the operating system, the bootcode in the MBR is
read first. This allows the computer to interpret the rest of the MBR.

The volume bytes: these are 4 bytes that are located after the
bootcode and just before the partition table. Windows 2000 and Windows
XP use these 4 bytes to identify the mountable volumes on the hard disk.
If these bytes are changed or erased from the MBR, Windows 2000/XP will
go through a simple hardware detection round that will re-identify all
the volumes on the disk. This is done during the next Windows startup
after changing the volume bytes. Drive letters assigned to volumes might
change after this. This goes for simple volumes, I have at this point no
information on the effect of removing the volume bytes when using
dynamic volumes.

The partition table: this is a sequence of 64 bytes (4 x 16) that
identify the first 4 (or less) primary partitions on a hard disk. There
is space for identifying 4 partitions. Each partition-identification is
made up of 16 bytes that describe a number of things about the
partition, such as: where it starts, what type it is, how big it is, is
it an active partition or not, etc. One of these 4 partition
descriptions can be used to describe an extended partition, which itself
can then contain logical drives. The logical drives are not described in
the MBR.
An active partition is the partition from which the Operating System is
started. This must be a primary partition, and there can only be 1
primary partition active at any time.
If there are for instance only 2 partitions on a hard disk, the first 32
bytes of the partition table (2 x 16) would contain the descriptions of
those partitions. The other 32 bytes would contain all zeros. So
deleting a partition consists of putting zeros in the chosen partition
description.

The signature bytes: these are 2 bytes that are used to signify an
important sector. They can be found trailing the MBR, but there are
other sectors that contain these bytes as well. If they are not trailing
the MBR the computer will not be able to read the MBR (because it will
not be recognized as an important sector).

So, the MBR consists of:

440 bytes of bootcode, followed by

4 bytes with volume information, followed by

2 bytes that are (as far as I know) not used, followed by

64 bytes that contain the partition descriptions, followed by

2 bytes that "close up" the MBR

This makes a total of 512 bytes.

A word about Unix based Operating Systems:
The main difference between a Unix based MBR and a Windows based MBR is
the bootcode. Unix based bootcode has the ability to look for partition
information outside the MBR. So it should be clear that replacing Unix
bootcode with Windows bootcode could render a system un-bootable.
MBRtool is not Unix bootcode aware, so be careful when playing with the
bootcode. MBRtool only writes Windows based bootcode. However, all
non-bootcode-related actions (backups, editing partition tables, etc.) can
be used for all platforms.

MBRtool is the only tool that let's you play with each part of the
MBR, so be sure to understand that MBRtool is a very powerful piece of
equipment.

manipulate the volume bytes that are associated with volumes in
Windows NT / 2K / XP

MBRtool can be run from the command line or from the MBRtool menu.
Type "MBRtool.exe" (without parameters) to use the menu. Type
"MBRtool.exe /?" to see the parameter list. MBRtool returns
errorlevels to DOS so that when the program runs from a batch-file
results can be tested. Errorlevels are only returned if the program is
run with the command line parameters, no errorlevels are set when the
MBRtool menu is used.

MBRtool supports the first 4 hard disks that the BIOS
finds. This means that the controller type or the disk type is not
relevant. However, if the BIOS does not see the disks or arrays, MBRtool
will not see any disks either.

Backups can be made from the MBR to sector or to file.

MBR Backups to sector: MBRtool can be left to
auto-select a target sector for the backup or MBRtool can be forced to
use a sector, no matter what it contains. Use /SEC
to let the program auto-select a target-sector from the range 2 - 10 or
enter /SEC:x (where x is the
sector) to force the program to write the backup to the selected sector.auto-select (/SEC): the
program uses the sectors 2 through 10, on track 0 on the disk that
contains the MBR you wish to back-up, to write the backups. MBRtool uses
a clever method to determine if the target sector contains anything that
has to be there (like drive-overlay signatures) and if anything is
found, the sector will not be used for backups. MBRtool starts with
sector 10 and works its way down to sector 2. If all sectors are used
(for either backups or anything else) the program will not make a
backup. You can list or clear the backups using a command described
later.select sector (/SEC:x): If
a backup to sector is selected using /SEC:x
the backup will be written to the specified sector, no matter what it
contains. Be careful with this. Only use this if you know the target
sector is clear or contains an (old) MBR backup.
You can let the program check to see if the target sectors are clear
using one of the options described later.

In practice: if you only make a backup every now and then and wish to make
the backup to sector, run MBRtool using the auto-select sector method.
Example: MBRtool.exe /BCK /DSK:0 /SEC.
Once you run out of target sectors, clear them and start over.
If you wish to make regular backups, and wish to automate this by
putting MBRtool in the Autoexec.bat (or any other procedure that runs
often), use the select sector method.
Example: MBRtool.exe
/BCK /DSK:0 /SEC:10.

MBR Backups to file: MBRtool places the file containing the
MBR backup in the current folder. If the file already exists it will be
overwritten. Use /FIL without a filename to use the default filename
(MBR_BACK) or use /FIL:filename to enter a filename to be used for the
backup. The maximum length for the filename is 8 characters. Do not enter the extension.
The extension is added by MBRtool and will consist of the physical disk
number that contains the original MBR, 128 through 131.
It should be obvious that making a backup to file on the disk that
contains the MBR is not wise. In case of disaster the file can not be
used for recovery, because you cannot read the disk. Place MBR backups
to file on a different disk than the one containing the original MBR.

If you wish to make MBR backups to file and retain a history of
backups, use the following batch-file as an example to achieve this. The
example will retain the last 3 backups, but can easily be expanded:

The Backups: The backups are changed so that the program
recognizes them as MBR backups. This means that the backups themselves
are not usable, they must be restored using MBRtool.
It is, however, possible to recover a MBRtool backup sector without the
use of MBRtool.
Let me explain: a conventional MBR has what we call a signature. This
signature consists of 2 bytes at the end of the sector that contains the
MBR. When MBRtool makes a MBR backup to a sector or a file MBRtool changes this
signature and replaces it with something MBRtool recognizes. The
original signature is put back in place when a restore is performed. The
original signature for a MBR is Hex "55 AA". MBRtool replaces
this with Hex "BB BB". Therefore, if you wish to manually
restore a backup sector to the original MBR sector, you must change the
last 2 bytes back to Hex "55 AA". A manual restore operation, without the
use of MBRtool, can be performed with a hex-editor. Explaining this
procedure does not fall within the scope of this manual.
A manual recovery of a backup made to file is also possible, though
somewhat more labor-intensive. If you open a backup-file you will see
that it is made up as follows: the first 3 lines contain the program
name, the program version and the disk number. The lines following that
contain the hex-representation of the MBR. Each line contains 32 bytes,
each byte being a 2 digit Hex number. There are 16 lines, making up the
512 byte MBR. Please note that the 32 bytes (each consisting of 2
digits) on each of the 16 lines also contain control values. These are
placed at the end of the line after the 32 Hex-bytes. So be careful when
using this restore method, use only the first 32 hex-bytes (meaning the
first 64 digits) on each line and discard the rest.
Use a Hex-editor to enter the hex values you see here in
the MBR. Don't forget about the signature bytes.
It should be obvious that the preferred and most logical way to restore
backups, is to use MBRtool. The above examples are given to help users
with recovery scenarios in which they might not have the use of MBRtool
(for whatever reason).

The method: MBRtool uses int13H calls to access the
hard disk through the BIOS. This means that the program will NOT work
from within
Windows NT or Windows 2000 and later versions (these versions prohibit access to hardware). If
you wish to use MBRtool on a system running Windows NT or Windows 2000
and later,
you must use a real-mode DOS boot disk. If you run into problems running
the tool from Command prompts in Windows 9x or ME, use a real-mode
boot disk.It is advisable to run MBRtool only from a real-mode (DOS) boot disk.
On systems running Windows 9x it is possible to add MBRtool to the
autoexec.bat for automatic creation of MBR backups. Windows ME does not
allow this.
On Windows 9x systems it is possible to run MBRtool from a Command
prompt in protected mode. Windows ME does not allow this. If MBRtool is
asked to write a backup to sector under Windows ME, it will inform you
that the backup is NOT written. Windows ME does not allow write-access
to sectors in protected mode. This means that making a backup to file
will work okay.

How to use

MBRtool can be used from the command line or from the MBRtool menu.
The menu is displayed if no options are entered on the command line.
MBRtool can be controlled either from the command line or from the menu.
Both offer the same functions.
The program runs in real-mode DOS
or a Command prompt in Windows 9x or ME.

Using the command line

"MBRtool /?" will display the help-screen and the
copyright notice.
Please look at the examples below to gain a better understanding of the command line.
The command line arguments consist of the following:

/xxx - select the
action to be performed,
where xxx is the selected
action (BCK, RST etc.)/PTM:XyXyXyXy - change
partition attribute X
for partition y (max 4
times in 1 command)/DSK:n - select disk to
perform the operation on, where n
is one of: 0,1,2,3 or A for all/SEC - select a sector
as target, the program will auto-select a target sector.
OR/SEC:n - select a
sector as target, force the program to write the backup to sector n

/FIL - select a file
as target or source for a backup, the program will use the default
filename
OR/FIL:filename - select a
file as target for a backup, using the filename entered. No extension,
the filename must not exceed 8 characters in length

Note:

selecting all disks (/DSK:A)
is only valid for Backup, Checking target sectors, Listing/Clearing backup
sectors and Saving track 0. The requested action will only be performed
on disks that actually exist. This is checked by MBRtool before the
actions are performed.

when performing a Restore, Verify, Display or Edit function on a
backup, you must use /SEC:n
or /FIL:filename to
specify the location of the backup. If /SEC
or /FIL is not entered,
the selected action will be performed on the original MBR.

a filename must be entered (/FIL:filename)
when backing up or restoring a track 0.

backup and restore to/from sectors all happen on the disk
where the
original MBR is located, meaning: making a backup of the MBR on
disk 1 to a backup sector will place that backup in the selected sector on disk 1.

MBRtool assumes the first disk to be disk 0, the
second disk 1 etc.

Examples:

MBRtool /DSP /DSK:0 - will
display the MBR for disk 0MBRtool /BCK /DSK:a /SEC - will
backup the MBR of all disks to the first available sector on the disksMBRtool /BCK /DSK:1 /SEC - will backup
the MBR of disk 1 to the first available sector on disk 1MBRtool /BCK /DSK:0 /FIL:my_mbr -
will backup the MBR of disk 0, to file "my_mbr"MBRtool /RST /DSK:0 /FIL:my_mbr -
will restore the MBR from file "my_mbr", to disk 0MBRtool /BCK /DSK:0 /SEC:3 - will
backup the MBR of disk 0, to sector 3 on disk 0MBRtool /RST /DSK:0 /SEC:9 - will
restore the MBR to disk 0, from sector 9 on disk 0MBRtool /PTM:h1a2 /DSK:0 - will hide
partition 1 and activate (and thus un-hide) partition 2 on disk 0MBRtool /PTM:z1 /DSK:0 /FIL:my_mbr
- will zap (delete) partition 1 in backup file "my_mbr"MBRtool /WT0 /DSK:0 - will wipe
track 0 on disk 0MBRtool /RBC /DSK:0 - will refresh
the bootcode in the MBR on disk 0MBRtool /RBC /DSK:0 /FIL:my_mbr -
will refresh the bootcode in backup-file "my_mbr"MBRtool /RBC /DSK:0 /SEC:6 - will
refresh the bootcode in the MBR-backup on sector 6 of disk 0MBRtool /EPT /DSK:0 - will start
the partition table editor to edit the partition table in the MBR on
disk 0MBRtool /EPT /DSK:0 /FIL:my_mbr -
will start the partition table editor to edit the partition table in the
backup file "my_mbr"

Using the menu

Typing "MBRtool.exe" without parameters will bring up the
menu. All functions that are available from the command line are also
available from the menu.
The menu will not be explained in-depth, it is self explanatory. To
learn about the menu options, read the section below on the command line
arguments to understand what everything does.
Important things about the menu:

use the Escape key to exit the program, exit a menu or to abort
input.

in the top right hand corner of the screen you can see how many
disks MBRtool has found. Next to the text "Disks" you will
see 4 numbers (from 0 to 3) in green or in red. Green means a disk
is found on that port, red means no disk is found on that port. When
a disk is selected during the use of the menu options, the
corresponding disk number will light up.

to the right of all menu options, you can see the corresponding command line
option.

you can also use all command line options from the menu, as a
shortcut. For instance, from the menu prompt, type "/DSP
/DSK:0" to display the MBR from disk 0. Type "/?" to
see the command line help screen.

you can run a DOS command from the menu using the ">"
character. For example, to delete a MBR backup file, you can type
">del backup.128". When the DOS command is finished,
you will be returned to the menu. Type ">" to
shell to DOS, then type "exit" when you're finished.

where MBRtool asks you the following:
"- enter type, 'O' for original, 'S' for sector, 'F' for file -"
Original is the original MBR or track0 on the disk,
Sector is the MBR backup on a backup sector,
File is the MBR backup or track0 backup from a backup file.

options marked with a yellow dash instead of a white dash can be executed for original and
backups.

the menu does not perform any validity checking on the values that
are entered. All validity checking is handled by the main program.
Therefore any error notifications will only be shown after the last
value was entered and the program tries to perform the requested
action.

Type "?" (plus Enter) from the menu-prompt to see a
shortened version of these directions.

The layout of the options across the
menus is as follows:

The Main menu:

1 - perform automatic backup of all
MBRs to disk
2 - perform automatic backup of all MBRs to file
3 - perform automatic backup of all track0s to file

/BCK - perform a MBR
backup.
A disk must be selected (/DSK:0 -
/DSK:3
or /DSK:A for All). If /DSK:A
is selected a backup is made of all MBRs on the first 4 disks.
A target for the backup must be specified. Choose /SEC
or /SEC:x to make a backup to a sector on the same
disk as the original MBR.
Choose /FIL or /FIL:filename
to
make a backup to a file that will be written to the current folder or disk.

/RST - restore a MBR
from a previously made backup.
A disk must be selected (/DSK:0 -
/DSK:3). The location of the backup must be specified through /SEC:n
or /FIL:filename.

/VFY - verify a backup
against the original MBR, or validate a backup.
A disk must be selected (/DSK:0 -
/DSK:3). The location of the backup must be specified through /SEC:n
or /FIL:filename. This
option will also validate the backup and tell you if it has been
corrupted, so you can use this option to simply tell if you can use the
backup without it being important whether the backup is identical to the
MBR.

/CHK - check target
sectors.
A disk must be selected (/DSK:0 -
/DSK:3
or /DSK:A for All). This
option will check the sectors that are used for backups to sector. The
sectors 2 through 10 on track 0 are checked to see if they are free for
use. If the sectors already contain data or backups, they will not be
used for backups if the auto-select method is used.

/LST - list the sectors
that contain a backup.
A disk must be selected (/DSK:0 -
/DSK:3
or /DSK:A for All). This
option will list the sectors on track 0 that have been used for backups
using the backup to sector.

/CLR - remove the
backups from the backup sectors.
A disk must be selected (/DSK:0 -
/DSK:3
or /DSK:A for All). This
option will clear all the sectors on track 0 that have been used for
backups using the backup to sector. Only backups will be removed. If the
sector contains other data, the sector will be left alone.

/ST0 - backup up the
entire track 0.
A disk must be selected (/DSK:0 -
/DSK:3 or /DSK:A
for All) and a filename must be entered (/FIL:filename).
This option will dump the entire track 0 (including the MBR) for the selected disk to a
file. The file will only contain the exact image of the track 0 and
nothing else. These files can be used to perform remote editing on track
0 by using a hex-editor, or to safely look around in track 0 using a
hex-editor without the risk of damaging the real track 0. Of course they
can also be used as simple backups.

/RT0 - restore the
entire track 0.
A disk must be selected (/DSK:0 -
/DSK:3) and a filename must be entered (/FIL:filename).
This option will restore the entire track 0 (including the MBR) to the disk that has been
selected on the command line. Please note that the extension for the
file will determine which disk was selected. If the disk selected on the
command line is not the same as the disk portrayed in the file
extension, the restore will not proceed. To force this (if necessary),
rename the file.
The restore will not proceed if the geometry values for the target disk
differ from the geometry values used to write the track0 file.

/VT0 - verify track 0
backup against the original on disk.
A disk must be selected (/DSK:0 -
/DSK:3) and a filename must be entered (/FIL:filename).
This option will verify/compare the backup against the original track 0
on disk. When this action is selected MBRtool will display a screen with
the number of sectors (maximum 63). The original track 0 is read, the
backup track 0 is read and the differences will be displayed, per
sector. A different sector will be marked by an "X". Identical
sectors will be marked by a ".".
The verify will not proceed if the geometry values for the source disk
differ from the geometry values used to write the track0 file.

/WT0 - wipe entire track
0.
A disk must be selected (/DSK:0 -
/DSK:3). This option will wipe the entire track 0 (including
the MBR). Track 0 will
be filled with null-characters. Use with caution. This will also wipe
any disk-manager signatures. Use this option to for instance kill
disk-manager signatures or to clean the hard disk to prepare for a clean
install.

/CT0 - clean track
0.
A disk must be selected (/DSK:0 -
/DSK:3). This option will clean track 0 on disk. This means
that track 0 will be wiped except for the MBR. This can be used
to remove disk-overlay leftovers or to clear the MBRtool backups. This
would also wipe signatures left by for instance Symantec Ghost or
Powerquest Partition Magic.

/DT0 - dump track0
(either the original or a file-backup) to a text-file.
A disk must be selected (/DSK:0 -
/DSK:3). If /FIL:filename is not
used, the original track0 is dumped. When dumping a backup, the
location of the backup must be specified through /FIL:filename.
The resulting text-file is free of ASCII control-characters
and should print normally to any text printer. The target file for the
dump is MBRTOOL.DMP and will be placed in the current directory. If this file does not exist at the time the command
is run, it will be created. If the file already exists, the new dump
will be added to the file. The dump-file contains a datestamp in the
format mm-dd-yyyy for each track0 dump, to keep track of when the dump was
created.

/NEW - write a blank
MBR-backup file.
A disk must be selected (/DSK:0 -
/DSK:3) and a filename must be entered (/FIL:filename).
This option will create a blank MBR-backup file. This can be used to
recreate a MBR from scratch and restore it later. This could be handy
for remote recovery support.

/DSP - display the MBR,
either the original or a backup.
A disk must be selected (/DSK:0 -
/DSK:3). If /SEC:x
or /FIL:filename is not
used, the original MBR is displayed. When displaying a backup, the
location of the backup must be specified through /SEC:n
or /FIL:filename. If the
requested action was performed on a backup, this
option will also validate the backup and tell you if it has been
corrupted.
On the display screen in the HEX display part the volume bytes will be
highlighted. Also the first byte for each partition table entry will be
displayed in yellow. Below the HEX / ASCII representaion of the MBR is a
list of all partition table entries in readable (decimal) format.
The BIOS values for Heads/Sectors for the selected disk are also
displayed, for reference and for use in the Partition Table Editor.

/DMP - dump the MBR (either
the original or a backup) to a text-file.
A disk must be selected (/DSK:0 -
/DSK:3). If /SEC:x
or /FIL:filename is not
used, the original MBR is dumped. When dumping a backup, the
location of the backup must be specified through /SEC:n
or /FIL:filename. If the
requested action was performed on a backup, this
option will also validate the backup and tell you if it has been
corrupted. The resulting text-file is free of ASCII control-characters
and should print normally to any text printer. The target file for the
dump is MBRTOOL.DMP and will be placed in the current directory. If this file does not exist at the time the command
is run, it will be created. If the file already exists, the new dump
will be added to the file. The dump-file contains a datestamp in the
format mm-dd-yyyy for each MBR dump, to keep track of when the dump was
created.
The BIOS values for Heads/Sectors for the selected disk are also
included, for reference and for use in the Partition Table Editor.

/WPE - wipe the MBR,
either the original MBR or a backup.
A disk must be selected (/DSK:0 -
/DSK:3). If /SEC:x
or /FIL:filename is not
used, the original MBR is wiped. When wiping a backup, the location of
the backup must be specified through /SEC:n
or /FIL:filename. If the
requested action was performed on a backup, this
option will also validate the backup and tell you if it has been
corrupted (although that is rather uninteresting when wiping it,
nevertheless).

/BPT - blank the
Partition Table, either in the original MBR or a backup.
A disk must be selected (/DSK:0 -
/DSK:3). If /SEC:x
or /FIL:filename is not
used, the original MBR is selected. When blanking the Partition Table
in a backup, the location of the backup must be specified through /SEC:n
or /FIL:filename. The
bootcode is NOT blanked. If the requested action was performed on a
backup, this option will also validate the backup and
tell you if it has been corrupted.

/WBC - blank the
bootcode, either in the original MBR or a backup.
A disk must be selected (/DSK:0 -
/DSK:3). If /SEC:x
or /FIL:filename is not
used, the original MBR is selected. When blanking the bootcode in a
backup, the location of the backup must be specified through /SEC:n
or /FIL:filename. The
Partition Table is NOT blanked. If the requested action was performed on
a backup, this option will also validate the
backup and tell you if it has been corrupted.
Note: wiping the bootcode will wipe the entire section of the MBR that
is reserved for bootcode, so that includes the Windows NT / 2K / XP volume
bytes.

/RBC - write/refresh the
bootcode, either in the original MBR or a backup.
A disk must be selected (/DSK:0 -
/DSK:3). If /SEC:x
or /FIL:filename is not
used, the original MBR is selected. When writing the bootcode in a
backup, the location of the backup must be specified through /SEC:n
or /FIL:filename. The
Partition Table is NOT blanked. If the requested action was performed on
a backup, this option will also validate the
backup and tell you if it has been corrupted.
Note: the bootcode that is written using this option is generic Wintel
bootcode and can be used for all Win/DOS platforms. If you have the
Linux LiLo bootcode in your MBR DO NOT USE this option, it will
leave your system unusable.
Note: refreshing the bootcode will only refresh the section of the MBR
that is actually used for bootcode, and will not remove the Windows NT / 2K / XP volume
bytes. So it is possible to refresh the bootcode without destroying the
mountable volume information.

/ZVB - zap (remove)
the volume bytes from the MBR, either the original or a backup.CAUTION: this option can be destructive. Use with care. Read the volume
bytes part in the manual for more info on the volume bytes.
A disk must be selected (/DSK:0 -
/DSK:3). If /SEC:x
or /FIL:filename is not
used, the volume bytes will be removed from the original MBR.

/RVB - restore the
volume bytes to the MBR.CAUTION: this option can be destructive. Use with care. Read the volume
bytes part in the manual for more info on the volume bytes.
A disk must be selected (/DSK:0 -
/DSK:3). The location of the backup must be specified through /SEC:n
or /FIL:filename.

/SIG - write the
signature bytes for the MBR.
A disk must be selected (/DSK:0 -
/DSK:3). This option can only be performed on the original MBR.
Use this option if something or someone has corrupted the MBR by
removing the 2 signature bytes from the MBR.
Please note: when a backup is restored the signature bytes are automatically
written.

/EPT - edit the MBR
Partition Table, either for the original or a backup.
A disk must be selected (/DSK:0 -
/DSK:3). If /SEC:x
or /FIL:filename is not
used, the original MBR is selected. When editing a backup, the location
of the backup must be specified through /SEC:n
or /FIL:filename. If the
requested action was performed on a backup, this
option will also validate the backup and tell you if it has been
corrupted. Please check below for information on the editor.

/PTM - change attribute
for partitions that are listed in the MBR, either in the original MBR or a backup.
A disk must be selected (/DSK:0 -
/DSK:3). If /SEC:x
or /FIL:filename is not
used, the original MBR is selected. This option can be used to change
the attribute for the selected partition. Use the command as follows: /PTM:XyXyXyXy,
where X is the selected
action (A for activate, D for de-activate, H for
hide, U for unhide, Z for zap) and y
is the selected partition (1-4).
Example: /PTM:A2H1. This
will activate partition 2 and hide partition 1.
This option can be used as a quick boot selector for multiple primary
partitions, or to hide and unhide partitions without having to use a
partition manager.

IMPORTANT:

"hide" will automatically
de-activate a partition, "activate" will automatically un-hide
a partition.
Remember to hide the other primary partitions when using this option as
a bootable partition selector.

the number used to identify a partition in the /PTM parameter is
the number of the entry for that partition in the partition
table. So "/PTM:a1" will activate the partition that is
defined in the first entry in the partition table in the MBR.

The Partition Table editor

When the /EPT option
is selected the Partition Table editor is displayed.
The screen displays the table twice. The top section displays the table as
it is now, either from the original MBR or a backup. This
is signified by the word "cur" on the left in the blue
top-bar. Directly below the first display of the table is the
option-bar.
This bar contains the options that are valid in the editor. Below the
option-bar is the second display of the table. This table will reflect
the changes you make during the editing. This is signified by the word
"new" on the left in the blue top-bar.
Both displays of the Partition Table also contain the displaying of the
entries as they are recorded in the MBR (under "partition table as
shown in MBR"), for reference.
The bottom display of the table and MBR reference will be refreshed
after each value change.

Each Table consists of 4 entries, making up the Partition Table. The
entries contain, from left to right (as is also displayed in the blue
top-bar) the 10 following values:

Partition Active, Decimal

Partition Type, Hex

Start Cylinder, Decimal

Start Head, Decimal

Start Sector, Decimal

End Cylinder, Decimal

End Head, Decimal

End Sector, Decimal

LBA Start Sector, Decimal (32 bit value)

LBA Length, Decimal (32 bit value)

The following options are valid when in the editor (as displayed in
the menu-bar):
Press 'Esc' to leave the editor. Any changes made will NOT be
saved.
Press 'S' to save the Partition Table you have edited to either
the original MBR, or a backup.
Press 'R' to revert the changes you made. All Table entries will
be restored to their original values, as displayed in the Table in the
top section of the screen.
Press 'B' to set all values to 0 and create a clean Partition
Table to fill.
Press 'G' to use custom values for Heads/Sectors (these values
are used for LBA calculations).

This option is a toggle. Press 'G' once to enter the new value for Heads
and for Sectors. Press 'G' again to use the values from the BIOS. On the
3rd line from the top you can see what the current values are and where
the editor gets them from (BIOS or CUST). This option is useful when
editing the Partition Table in a backup on a different computer than the
one that the backup was made from. If the Heads/Sectors geometry values
are different on the two computers, you can use custom values to
correctly calculate the LBA values. It should be obvious that this is
very important, without correct LBA values in the Partition Table things
will not work as expected. To get the Heads/Sectors values from the
original computer, use a /DSP or /DMP command. The geometry values that
MBRtool uses are included in the output from these commands.

When you choose to edit one of the entries, you will be asked to
enter the values for that entry. The program will ask you to enter a
value for each of the 10 values that make up 1 entry. Press 'Esc' (or
'Enter'
without typing any value) to leave that value unchanged.
All values are entered and treated as decimal values, with one notable exception: the Partition Type. This is entered in Hex.
Example: the Active Partition value (the first value in an entry) is Hex
"80". In the table it is displayed as Dec "128". You
must enter "128" or "0" if you wish to edit the Active Partition
value.
However, the Partition Type value will for instance display
"0B", which means FAT32. If you enter a Partition Type value
you must enter this as Hex. It is beyond the scope of this manual to
list all partition types and how to manipulate partitions using this
value.

When you have entered the C/H/S values for start and end entries, the
program will calculate the LBA values for the last two fields that make
up the partition table entry. You will still be allowed to edit these
last two values, in case the calculations might be incorrect (this could happen
because of incorrect geometry information that the BIOS returns to MBRtool).
When performing edit functions
you should check the LBA calculations if you think your BIOS might
return illogical values for your disk geometry. The edit screen displays
the values that are used for LBA calculations at the 3rd line from the
top. If these values are incorrect, calculate the LBA yourself and enter
the values in the appropriate fields. The formula for calculating LBA
addresses is: LBAsector = ((Cyl * DiskHeads) + Head) * DiskSectors +
Sec - 1. Or you can use the Custom Values function ('G') in the editor.
Normally, when using C/H/S notations in partition tables you are not allowed to
enter values higher than the following: 1023 for Cylinders / 254 for
Heads / 63 for Sectors (this restriction comes from days long gone by,
when disks where not as large are they are today). To correctly
calculate the LBA values it should be obvious that the true values for
C/H/S should be entered, even if they are higher than the mentioned
maximum values. In MBRtool you should always enter the C/H/S values as they should
be used for the LBA calculations (higher than the maximums or not).
MBRtool will reset the C/H/S values to their allowed maximum after they
have been used to perform the LBA calculations.

The values you enter are checked for consistency. You are allowed to
enter more than 1023 cylinders, to correctly calculate the LBA address.
However, you are not allowed to enter values higher than your disk
geometry for heads or sectors.

Windows
NT / 2K / XP Volume Bytes

All Windows versions that use NTFS (Windows NT, Windows 2000,
Windows XP etc.) change 4 bytes in the MBR,
at the end of the bootcode. These bytes, known as the Volume Bytes or
the Admin Bytes, are used for recording
information about so-called "sticky drive letters" and for
other drive-letter assignments (check the
Windows documentation for info on this. Info can be found in the
Resource Kit or the Knowledgebase, which are both available on-line at www.microsoft.com).
This means that if you refresh the bootcode using ANY OTHER TOOL THAN
MBRtool these bytes will be overwritten. MBRtool is aware of these
volume bytes and leaves them undisturbed when refreshing the bootcode. Please note that the current version of MBRtool is
also capable of restoring the volume bytes from a backup to the current MBR on
a disk,
effectively offering support for volume bytes.

Consider the following scenarios, where you might have lost the
volume bytes by for instance using fdisk /mbr:

If you have NO simple or dynamic volumes (in Windows NT4 also
known as stripesets or mirrorsets):

If you have a current backup of your MBR that was made using MBRtool,
you can restore the volume bytes from that backup. Check the parameter
description for "/RVB" to read how to do this.
If you have no backup of your MBR there should still not be need for
much concern. Windows will ask
you if you want to restart the system after the next successful boot.
This is because Windows has reloaded some drivers that have to do with
volume mounting and -detection, a direct result of the fact that the
volume bytes are no longer present. Answer "Yes" to
restart your system. At this point Windows has refreshed the volume
bytes in
the MBR and all is well (you may have lost some drive letter assignments,
but that can easily be changed back to the way you had it before, by
using the Windows disk manager). You might want to consider making a backup of
the MBR with the Windows 2000 / XP changes.

If you use Simple or Dynamic volumes (or the
Windows NT4 equivalent):

If in this case the volume bytes are wiped it is most
likely that some or all volumes are no longer visible to Windows.
Perform the necessary recovery by trying to import unknown volumes or by
trying to revive volumes. A description of this does not fall within the
scope of this manual. Check the Microsoft knowledgebase for information.

These scenarios are provided as examples, to clarify
the use of volume bytes.

Again, please note the following:

The "/WBC"
parameter will wipe the entire section of the MBR that
is reserved for bootcode, so that includes the Windows NT / 2K / XP volume
bytes.

The "/RBC"
parameter will only refresh the section of the MBR
that is actually used for bootcode, and will not remove the Windows NT / 2K / XP volume
bytes. So it is possible to refresh the bootcode without destroying the
mountable volume information.

CAUTION: the MBRtool functionality of dealing
with volume bytes is built on real world tests, as it is difficult
to find solid information on how Windows deals with this. Therefore it
is possible that MBRtool does not achieve the desired effect when
working with volume bytes. Always make backups of your system and your
MBR when working with volume bytes.

Run
errors, program notifications and errorlevels

Program
notifications

In
a normal MBRtool run all the messages displayed are notifications. The
program informs you of the operation that has been requested and what
the result is. If the displayed message starts with a '-'
(as in '- Backup NOT written to sector')
it means that something has gone wrong and that the operation was not
completed, or was aborted. This usually means that MBRtool could not get to
the necessary resources (the backup-sector, the backup-file or the MBR)
to complete the action. Check to see if the backup-sector or backup-file
are not corrupted (by displaying them) and check to see if you have
selected an existing disk for the operation.
When the message '!- could not
read/write selected disk (RC=x)' appears it means that an Int13H
error occurred, meaning that the disk could not be read or written to.
The text 'RC=x' in the Int13H
error message means Return Code. An Int13H error usually returns a value
that lets you identify the error. The most common errors are RC=1 (disk
error/nonexistent disk) and RC=3 (read-only error, is displayed when
sector operations are performed under Windows ME).

Errorlevels

MBRtool returns errorlevels when used from the command line. These
errorlevels can be used to test for results when MBRtool is called from
within a batch-file. The errorlevels are:

0 - correct execution of the requested action

1 - syntax error in the command line

2 - minor problem encountered (not possible to write/create a backup)

3 - major problem encountered (not possible to perform a restore)

4 - MBRtool encountered a problem it could not recover from. The
program aborts and displays the relevant error codes. Include these error codes
in the error-report when asking for support

When the program exits, the highest encountered errorlevel during
program execution is returned to DOS. This errorlevel value is also
displayed by the program on exit.

Errorlevels are not returned or displayed when the MBRtool menu is
used.

If something unexplainable happens and you ask for support, be sure to
include any messages the program displays.

If
a situation occurs that MBRtool can not handle, the program will abort
with an error message. Please send the message with the error codes to
us (see contact information)
and we'll get back to you as soon as we can.

Tools used in
creating MBRtool and other copyrights that need mentioning

MBRtool was created using Powerbasic for DOS, version
3.5.

All mentioning in the text of "win9x/DOS "
refers to MS-Windows, (c) Microsoft Corporation.
The mentioning of Symantec and Powerquest acknowledges the copyrights
that exist for their products.

Known issues
for this version

Still none yet.

Version
history

Current version: 2.3.200

Changes since version 2.3.100

maintenance (manual changes/updates and a few source code
updates/spelling fixes)

Changes since version 2.2.100

disk geometry detection changed (added head-fix)

added a boot diskette builder

Changes since version 2.1.100

the /RBC parameter (refresh bootcode) is now Volume Byte aware. refreshing
the bootcode will no longer overwrite the volume bytes, and
thus leave the volume information contained in the MBR intact.
please note that wiping the bootcode (/WBC) WILL remove the
Volume Bytes

manipulation of volume bytes has been adapted, only the 4 correct
bytes can be erased or restored

bootcode is replaced with US English XP bootcode

minor cosmetic changes in some screens

Changes since version 2.0.150:

added the MBRtool menu, including the possibility to run commands
from the menu prompt

added the dump track 0 function (/DT0)

added a Custom Geometry Value function to the Partition Table
Editor

feedback on errors during restore / verify track0 improved

for /DSK:A, the requested action is only performed on actually
existing disks. MBRtool now tests for disk existence before any
action is performed

a backup count per disk is added to the /LST function

error checking has been changed, is now handled globally

maximum cylinder value in the Partition Table Editor is changed
from 9999 to 99999

geometry values are added to Display and Dump output

Partition Table Editor has been changed to be a bit more friendly
to work with

Changes since version 2.0.100:

minor cosmetic changes

command line help screen is now displayed if the menu add-on is not
found

Changes since version 1.20:

the command line is revised, and is now easier to understand and
use

more on-screen information has been added to several functions

the value entered in the partition table editor for Active
Partition is now checked (must be 0 or 128)

saving and restoring of track 0 to file has been improved, it is
now much faster

the saving and restoring of track 0 is now more reliable (the
conditions and results are checked)

error display for track 0 functions and MBR backup functions has
been improved

fixed: problem in the Partition Table Editor when a non-existing
backup from sector was requested

new function: clean track 0

new function: verify track 0 against a previously made backup

new function: delete a Partition Table Entry from the command line

new function: added support for volume bytes (delete and restore)

new function: dump a MBR (backup or original) to file

added errorlevels for batch-file support

added a more elegant general-error exit routine

a new and more indicative version numbering system is introduced

Changes since version 1.10:

the version number. it seemed that version 1.01 and version 1.10
were the same to some software download sites

the support information has been changed

the manual has been updated and expanded

Changes since version 1.01:

major code overhaul

bug in backup to file for more than 1 disk fixed

check on maximum heads corrected

partition type is now displayed correctly in the editor (including
the attribute)

partition attributes can now be changed from the command line (/P
parameter)

display MBR now includes the Partition Table in editor format

added corruption check to the backup files

added function to write a blank backup (/X:A)

added error handling for reading the backup files

changed the sequence of items in the partition table display and
edit screens

added LBA calculations to the editor

added saving, restoring and wiping of track 0

added display of used disk geometry values for LBA calculations in
the edit screen

added possibility to delete 1 entry in the edit screen

Changes since version 1.00:

LBA values when entered in the Partition Table
editor are now checked. Due to a restraint in the compiler, I can not
calculate Hex values larger than Dec 2,147,483,647 (well, actually I
can but I haven't figured it out completely yet). This means for
now that you can not enter values for LBA larger than this. The
above mentioned value translates into a 1Tb hard disk size, so in
practice this will hardly pose a problem. However, people with hard disks/hardware raid5 systems larger than 1Tb should NOT use the
partition table editor that MBRtool provides. Backup and restore are
safe.
Version 1.00 of MBRtool simply crashed when a large value for LBA
was encountered. Though not quite nice, it means that no changes to
the MBR were made at runtime so no trouble there.